library privacy audits and search warrants: preparing for inquiries into user records karen coyle...

Library Privacy Audits and Search Warrants: Preparing for

Inquiries into User Records

Karen Coyle and Mary Minow

Infopeople WebcastNovember 4, 2004

Library Privacy Audits

Karen Coyle

Infopeople WebcastNovember 4, 2004

Housekeeping New interface! HorizonLive is now

HorizonWimba Today’s webcast:

– presentation: 100 minutes– Q&A: final 20 minutes

Submit your questions via ‘Chat’ during webcast so presenter gets them in time

Fill out evaluation during Q&A

Don’t wait for Q&A to submit questions

Webcast Archives: http://infopeople.org/training/webcasts/archived.html

When to Use Chat

Chat Area ThereList of Participants There

• Get help with technical difficulties •send message to “HorizonHelp”

• Ask presenter questions•send message to “ALL”

• Chat with other participants•“select name from dropdown list”

Privacy Today

Privacy Today

Privacy Today

111-22-3333

“Data Mining”

SSN

zip code

date of birthpublic records

“Data Mining”

SSN

zip code

date of birthpublic records

Privacy Today – in Libraries

Computer systems create records where none existed before

Privacy Today – in Libraries

Computer systems create records where none existed before

Library services go beyond library walls

Privacy Today – in Libraries

Computer systems create records where none existed before

Library services go beyond library walls Library network is part of a larger

networked world

Privacy Today – in Libraries

Computer systems create records where none existed before

Library services go beyond library walls Library network is part of a larger

networked world Any library data is in the context of the

“data soup”

What libraries can do....

Be responsible keepers of information about our patrons and library use

Be honest and informative

Service and Privacy

More service can require more user information

“Personalization” is ... personal

Security and Privacy

An insecure system cannot protect the privacy of users

Desire for security can lead to monitoring and logging of use

Rules for data collection

Only gather data that is absolutely necessary to perform the function

Do not keep data longer than is needed to perform the function

Limit access to those persons who must work with the data

Library Application Systems

Patron database Circulation records Fines and payments Document delivery ILL requests and fulfillments Electronic reserves OPAC logs

Circulation and Borrower Records

Library Application Systems

Saved searches or bibliographiesAutomated search profiles (SDI)Virtual reference“my library” personal viewemail services

Personalized Services

Library Web Site

Web server logs Proxy server logs Cookies Forms and email

Sample web log

204.123.28.31 - - [23/Jun/2002:02:21:31 -0400] "GET /reach.html HTTP/1.0" 200 2186 "-" "Mercator-2.0"204.123.28.31 - - [23/Jun/2002:02:21:39 -0400] "GET /htdig/search.html HTTP/1.0" 200 1083 "-" "Mercator-2.0"204.123.28.31 - - [23/Jun/2002:02:21:47 -0400] "GET /privacy-policy.html HTTP/1.0" 200 4406 "-" "Mercator-2.0"204.123.28.31 - - [23/Jun/2002:02:21:54 -0400] "GET /best.html HTTP/1.0" 200 5780 "-" "Mercator-2.0"204.123.28.31 - - [23/Jun/2002:02:22:01 -0400] "GET /upto.html HTTP/1.0" 200 4171 "-" "Mercator-2.0"204.123.28.31 - - [23/Jun/2002:02:22:13 -0400] "GET /cfp2002.html HTTP/1.0" 200 4745 "-" "Mercator-2.0"

Sample web log

Internet address of user: 204.123.28.31

Date and time: [23/Jun/2002:02:21:23 -0400]

Requested document: "GET /topiclist.html "

204.123.28.31 - - [23/Jun/2002:02:21:23 -0400] "GET /topiclist.html HTTP/1.0" 200 17602 "-" "Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)""

Browser: "Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)"

Sample web log

Internet address of user: 204.123.28.31

Date and time: [23/Jun/2002:02:21:23 -0400]

Requested document: "GET /topiclist.html "

204.123.28.31 - - [23/Jun/2002:02:21:23 -0400] "GET /topiclist.html HTTP/1.0" 200 17602 "-" "Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)""

Browser: "Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)"

Sample web log

Internet address of user: 204.123.28.31

Date and time: [23/Jun/2002:02:21:23 -0400]

Requested document: "GET /topiclist.html "

204.123.28.31 - - [23/Jun/2002:02:21:23 -0400] "GET /topiclist.html HTTP/1.0" 200 17602 "-" "Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)""

Browser: "Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)"

Sample web log

Internet address of user: 204.123.28.31

Date and time: [23/Jun/2002:02:21:23 -0400]

Requested document: "GET /topiclist.html "

204.123.28.31 - - [23/Jun/2002:02:21:23 -0400] "GET /topiclist.html HTTP/1.0" 200 17602 "-" "Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)""

Browser: "Mozilla/3.01-C-MACOS8 (Macintosh; I; PPC)"

Sample Web Log

“http:www.google.com/search?hl=en&ie=UTF-8&oe=UTF8&q=library+not+safe+place"

Can include searches

Public Workstations

Browser cache and history Cookies Saved data Login records Sign-up sheets or systems

Remote Services

Logons (in library or from home)PersonalizationStatistics

Databases and licensed services

Remote Services

User education

Internet use

The Internet is outside of the library

Privacy audit materials

http://www.kcoyle.net/infopeople/

For each:

What data exists?

Where is it located?

Who has access?

How long is the data kept?

For each:

What data exists?

Where is it located?

Who has access?

How long is the data kept?

What is gathered and what does reveal?

Who must have access to do their job?

How long is this data really needed?

Is it within the library’s control?

Example: Saved bibliography

What? Who? How long?

List of record IDs + Patron ID + Date created.Saved on server

Patron has access to their own; system admin has access to all; no other staff access

Purged at the end of each academic year; patrons can delete

Example: Saved bibliography

Remind users to delete saved bibliographies they are no longer using

Remove bibliographies for user accounts that are no longer active

Inform users that although the library wishes to provide a secure environment, it cannot guarantee the privacy of these files.

Example: Web logs

What? Who? How long?

Each request sent to library web server; includes: IP address of sender; item requested; browser...

Only systems staff have access

Stay on server until log file fills up; about 6 weeks

Example: Web logs

If using web logs for statistics, gather statistics immediately and then purge the logs

If logs must be kept, “anonymize” the user’s identity by removing all or part of the user’s incoming Internet address

Summary

Identify system areas where data is stored

Determine how long it is needed, and who should have access

Educate staff and educate users

Thank You.

Karen Coyle

http://www.kcoyle.net

Search Warrants: Preparing for Inquiries into User Records

Mary Minow

Infopeople WebcastNovember 4, 2004

Legal Disclaimer

• Legal information

•Not legal advice!

Responding to Requests for Patron Records

• Federal, State, Local Requests for records

• Records vs Observations

• Subpoenas vs Search Warrants

• Responding to Search Warrants

Records vs. Observations

Records• circulation

• registration • Internet sign-ups

(maybe)

Observations• “plain view” (what’s visible on screen)

• patron behavior• physical descriptions

California Law Protects Library Registration and Circulation Records

Administration of the library

Consent – Written

Order of superior

Exceptions ACC

California Govt Code Sect. 6267

Court

Records vs. ObservationsRecords• circulation

• registration • Internet sign-ups (maybe)

Observations• “plain view” (what’s visible on screen)

• patron behavior• physical descriptions

Need Court Order

Records vs. Observations

Records vs. ObservationsRecords• circulation

• registration • Internet sign-ups (maybe)

Observations• “plain view” (what’s visible on screen)

• patron behavior• physical descriptions

Need Court Order

Records vs. Observations

Don’t Need Court Order

Observations: Dead Body in Library Parking Lot

Memphis Public Library

Green Plymouth Fury

“massive amount of flies”

Police found dead body

Tennessee v. Rickman, 2002 Tenn. Crim. App. LEXIS 449 (May 17, 2002)

Observations: Tylenol Murders

Librarian tipped off FBI

Observations: Library Security Videotapes

Children reported man in bookshelves exposing himself

Library security tapes showed man leaning forward in bookshelves

Convicted - criminal sexual conduct

Minnesota v. Sihler, 2002 Minn. App. LEXIS 376

Observation or Records?

Facts:

Sept 15, 2001 Kathleen Hensman, reference librarian, Delray Beach recognized name of patron

Talked to library director

Called local police; forwarded to FBI

Delray Beach FL Library’s Legal Opinion: Observation

Legal opinion by library’s lawyers:

• Recollection not records

• Records released only after “properly drawn” order

May Release Electronic Communications … IF

Reasonable beliefemergency involving immediate death orserious physical injury

Sect. 212 Patriot Act, amending ECPA Sect. 2702

Requests for Records vs. Court Orders

These are not Court Orders:

Verbal Requests (even appealing to Patriotism)

Letter Requests

Subpoenas (unless issued by court)

Exigent Circumstances

Exigent Circumstances

Imminent• threat to life• serious threat to property• escape of a suspect• destruction of evidence

Imminent• threat to life• serious threat to property• escape of a suspect• destruction of evidence

OFFER TO PRESERVEEVIDENCE

DO: Preserve on oral request.Ask for written follow-up to clarify specifics.

Exigent Circumstances

When Computers Are Being Hauled Away

Options:

Get out of the way

Suggest library “preserve evidence” (get follow-up letter)

Point out King County case

“Kent child porn case closed,” Seattle Post-Intelligencer 09/10/02 seattlepi.nwsource.com/local/86306_library10.shtml

King County Library case

Police seized computers without a warrant

Federal District Court:police did irreparable harm to both privacy and property rights

Library filed suit; city settled >$30,000

Subpoenas vs. Search Warrants

Subpoenas vs. Search Warrants

GIVES YOU TIME e.g. 5 DAYS

EXECUTABLEIMMEDIATELY

Subpoena vs Search Warrant

Subpoena: commands person to appear before court or produce documents – time to consult with attorney

Search warrant:court order authorizing law enforcement to immediate search (Ask for time)

N.C. Gen. Stat. § 125-19  (2004)

Not all subpoenas are court orders

California law requires court order

Time to respond; call lawyer

Subpoenas – Many Kinds

Immediately executable

Search Warrants

Responding to a Search Warrant First Step: The Encounter

Identify the agent-in-charge. Ask for ID, business card. Check it out.

Tell agent-in-charge who is in charge (you) at the library.

Request (but do not demand) officers direct inquiries through you.

Ask for Copy of Search Warrant

Also ask for affidavit used to get the warrant – though you are unlikely to get this

ASK FOR BRIEF DELAY

Ask for brief delay to assemble team. If possible, escort the law enforcement officers to a private area.

If impossible, getout of the way

Get Warrant to Attorney

.

Fax warrantto Director who will get it toAttorney

(probably will ask person withOriginal to fax to attorney)

Next, Remind Staff of Their Roles.

Staff should not interfere

Staff need not talk to law enforcement:No “informal conversations”Inquiries regarding items’ location should

go to person-in-charge

But don’t tell staff they can’t answer questions

Careful not to “consent" to a broader search

Staff should not authenticate documents

Second Steps: The Attorney

The Attorney will ask to speak to the agent-in-charge (by phone if necessary)

Will emphasize that the library will do everything it can to ensure that the search proceeds smoothly, but would like to wait until library team arrives.

Verify Warrant

Consider asking for delay to litigate warrant’s validity (unlikely to succeed)

Tattered Cover v. Thornton, 44 P. 3d 1044 (Colo. 2002).

Judge or magistrate signatureJurisdictionExpiration

Closely Examine Scope

Exact premises to be searchedExactly what is to be seized

Negotiation here may be possible, (such as one hour of records instead of 30 days).

Make sure the search conducted does not exceed the terms of the document.

Appoint Note Taker

Assign note taking responsibility to someone on staff

other than principal team members

If law enforcement goes beyond the scope of the warrant, the attorney may ask them to desist.

No one should grant consent to go beyond the scope of the warrant.

Consider taking pictures of event.

If things go wrong..

Copy and Inventory Seized Items

Keep copies (or originals if possible) of items seized

Write your own inventory of items seized

Sample Federal Search Warrants and Subpoena Language

www.cybercrime.gov/s&smanual2002.htm

Sample Patriot Act Sect. 215 Order

www.aclu.org/SafeandFree/SafeandFree.cfm?ID=15327&c=262

Section 215 Gag Order for Library Staff

No person shall disclose to any other person (other than those persons necessary to produce the tangible things under this section) that the FBI has sought or obtained tangible things under this section.

Call ALA 1-800-545-2433 x4223 and simply say“I need to speak to a lawyer”

Recap: Responding to Requests for Patron Records

• Is request for patron records or observations?

• What type of request? Informal, Subpoena, Search Warrant, 215 order?

• Train all in-charge staff on how to

respond to search warrants

Want more? See Lee S. Strickland, Mary Minow & Tomas Lipinski, “Patriot in the Library: Management Approaches When Demands for

Information Are Received from Law Enforcement and Intelligence Agents,” 30 Journal of College and University Law 363-415 (2004)

www.cip.umd.edu/publications/patriot_in_the_library.pdf